Apple ordered to create software to help unlock a phone for FBI

[sharkov]

I can't believe people are boycotting apple over this. They are trying to protect the users

[Locke]

Originally Posted by sharkov

I can't believe people are boycotting apple over this. They are trying to protect the users

Yeah, Apple seem to be the good guys on this one.

[OldDutch]

Originally Posted by Locke

Yeah, Apple seem to be the good guys on this one.

Apple Unlocked iPhones for the Feds 70 Times Before

http://www.thedailybeast.com/article...es-before.html

Guess not everything is so black and white?

[FlameOn]

Originally Posted by OldDutch

Apple Unlocked iPhones for the Feds 70 Times Before

http://www.thedailybeast.com/article...es-before.html

Guess not everything is so black and white?

If that's the case, they already have the keys and aren't being asked to create something new. One thing is if you trust them with the keys or not. Second, what is the precedent here with bank and vault makers under subpoena to help in murder investigations?

“I think Apple did itself a huge disservice,” Susan Hennessey, who was an attorney in the Office of the General Counsel at the NSA, told The Daily Beast. The company acknowledged that it had the technical capacity to unlock the phone, but “objected anyway on reputational grounds,” Hennessey said. Its arguments were at odds with each other, especially in light of Apple’s previous compliance with so many court orders.

[Locke]

Originally Posted by OldDutch

Apple Unlocked iPhones for the Feds 70 Times Before

http://www.thedailybeast.com/article...es-before.html

Guess not everything is so black and white?

Of course it isnt, its all about the circumstances.

I'm leery of them referencing some 200 year old catch-all law to justify it though, if it was that important then they should have something a bit more modern and relevant.

[GGG]

Isn't there a difference between unlocking a phone for the government and developing a tool for the government to unlock phones.

[HotHotHeat]

Haha. Uh oh Cook.

Would be curious when the most recent time was prior to this. 2008 was iPhone 3G land. The phones probably had no encryption at all back then.

[FlameOn]

Originally Posted by HotHotHeat

Haha. Uh oh Cook.

Would be curious when the most recent time was prior to this. 2008 was iPhone 3G land. The phones probably had no encryption at all back then.

They've admitted they have the capability to do so for iOS9 which has encryption. It's no longer a question of whether or not security is compromised or even if it's a matter of costing the company money devoting engineering resources for creation of a tool. So if the capability is there, Apple already has it and has in the past cooperated with law enforcement, why is there such a stink now? That means Apple already has the keys and it's merely stalling because of a dent to it's reputation. Is creation of a tool for the FBI to use rather than passing the request directly to Apple such a big concern? Whole thing is starting to stink of media/user base manipulation.

[Bobblehead]

Well in the past iPhones were able to be hacked/unlocked by the maker - Apple. They would only do it when compelled to do so. And it was/is issues with being compelled to do this that this feature of the current version of iOS was created - to improve security which also resulted in Apple not being able to override it.

"Even WE cannot get into these phones, so stop asking"

I applaud Apple for rallying the tech sector to stand up against this sort of bullying.

[chaoticmonk]

No, Apple Has Not Unlocked 70 iPhones For Law Enforcement

http://techcrunch.com/2016/02/18/no-...w-enforcement/

[photon]

Originally Posted by FlameOn

If that's the case, they already have the keys and aren't being asked to create something new. One thing is if you trust them with the keys or not.

That's not the case though, the court order specifically requests creating something new because they can't decrypt the data because they don't have the key.

Originally Posted by FlameOn

They've admitted they have the capability to do so for iOS9 which has encryption.

Where? Unless the phone emails Apple a copy of the key every time you change your passcode, then they don't have the key.

Originally Posted by FlameOn

It's no longer a question of whether or not security is compromised or even if it's a matter of costing the company money devoting engineering resources for creation of a tool. So if the capability is there, Apple already has it and has in the past cooperated with law enforcement, why is there such a stink now?

There's a stink now because that's what's different about this request. They're asking Apple to create a tool that doesn't exist yet to help them brute force the pass code.

Originally Posted by FlameOn

That means Apple already has the keys and it's merely stalling because of a dent to it's reputation.

They don't have the keys, if they did then the court would have requested the keys, instead they're requesting a tool to brute force the passcode because the only thing that knows the key is the device itself.

Originally Posted by FlameOn

Is creation of a tool for the FBI to use rather than passing the request directly to Apple such a big concern?

Yes, because governments can and will illegally abuse tools and information for their own benefits to the detriment of the public and also have shown they can't keep things perfectly secured (no one can) so any tool has a chance of making into the hands of the people that the tool was ostensibly created to combat in the first place.

What if the government of Israel request this tool? China?

[Mike F]

I found this article helpful in really understanding what was being requested by FBI:

How dangerous is the tool the FBI is asking Apple to build?

....Tim Cook has described the tool as "too dangerous to create," potentially undoing years of security work that protects nearly a billion phones. At the same time, the government has portrayed that software as effectively harmless — a single software update targeted to a single phone. So how dangerous is this firmware update really?

For most iPhones, the danger comes from criminals rather than feds. The lock screen is one of the biggest protections against iPhone thieves, who often have to wipe a phone entirely after it’s been stolen. If those thieves had a way to unlock the stolen phones, victims could be exposed to anything from identity theft to extortion, depending on how much sensitive data is on the stolen phone. That threat was one of the main motivations for Apple’s shift to stronger encryption in iOS 8, and any software that unravels those protections could have serious consequences for iPhone users.

Because of that threat, the FBI’s proposed system has a number of protections to make sure its passcode hack can’t be used by anyone else. Apple has to sign any automatic firmware updates before a given iPhone will accept them, and the FBI's proposed update would be coded to an individual phone. Unless the phone’s serial number matches the serial number in the code, the software simply wouldn’t install. The method proposed by the FBI is also specific to the 5c, which lacks the Secure Enclave chip that ties lockscreen protections to hardware in more recent iPhones. Still, it’s likely that if the FBI is successful, the bureau will request similar methods for cracking Enclave-equipped phones.

But while the precise software proposed by the FBI can’t be used to unlock other phones, it can still be useful to thieves. If the code fell into the wrong hands, it could potentially be reverse-engineered into a generic version, removing the code that ties the attack to a specific phone. That reverse-engineered version would still need Apple’s signature before it could be installed — something thieves are not likely to have — but that signature system would be the only thing protecting a stolen iPhone and the information inside it.

[Wormius]

There was a Buzzfeed article that appears to indicate the FBI brought a bit of the mess upon itself, although I don't know how the auto iCloud backup may have helped.

The FBI had claimed in a court filing on Friday that the password was changed by someone at the San Bernardino Health Department, writing, "[T]he owner, in an attempt to gain access to some information in the hours after the attack, was able to reset the password remotely."

On Friday night, however, the San Bernardino County's official Twitter account stated, "The County was working cooperatively with the FBI when it reset the iCloud password at the FBI's request."

http://www.buzzfeed.com/johnpaczkows...ust#.eoEzGPvo7

[Resolute 14]

Why Apple is fighting this:

http://arstechnica.com/tech-policy/2...ngerous-to-do/

Some advocates of the government’s order want us to roll back data protections to iOS 7, which we released in September 2013. Starting with iOS 8, we began encrypting data in a way that not even the iPhone itself can read without the user’s passcode, so if it is lost or stolen, our personal data, conversations, financial and health information are far more secure. We all know that turning back the clock on that progress would be a terrible idea.

Law enforcement agents around the country have already said they have hundreds of iPhones they want Apple to unlock if the FBI wins this case. In the physical world, it would be the equivalent of a master key, capable of opening hundreds of millions of locks. Of course, Apple would do our best to protect that key, but in a world where all of our data is under constant threat, it would be relentlessly attacked by hackers and cybercriminals. As recent attacks on the IRS systems and countless other data breaches have shown, no one is immune to cyberattacks.

Again, we strongly believe the only way to guarantee that such a powerful tool isn’t abused and doesn’t fall into the wrong hands is to never create it.

[Locke]

Haha! It isnt Cyber-Attacks they need to worry about!

[Mike F]

Originally Posted by Resolute 14

Why Apple is fighting this:

http://arstechnica.com/tech-policy/2...ngerous-to-do/

I'm always turned off by the side being disingenuous with the facts, and as the story I linked to above set out, this analogy by Apple is disingenuous.

From what I understand, what Apple is being asked to create is a very powerful key to open one lock, with a fingerprint reader limiting it to only be usable by Cook. However, if it were to be stolen, and the thieves could find a way to modify it to be a generalized key, and they could also figure out how to bypass the fingerprint reader, it could be a true master key, capable of opening millions of locks.

Yes, Apple might be asked to make a series of such targeted keys, but not a generalized one.

If that's too much of a risk for you, even given the pressing need claimed by the FBI, you're free to your opinion. But at least you would have decided based on an accurate picture of the risk.

[You Need a Thneed]

If there is a key, the key could be reverse engineered. There is no guarantee that it stays one key for one phone, and if it becomes many keys, it will get out into the public.

[CorsiHockeyLeague]

So, until they actually appeal the thing this is basically a moot conversation.

[photon]

I don't see it as disingenuous at all, such a tool would be master key. Or a better description would be a bump key. A bump key doesn't unlock locks, it just abuses the lock in such a way to make getting at what's behind the lock trivially easy. They're being asked to invent bump keys.

No different than the people asking for back doors into encryption systems, this is just another kind of back door. It doesn't matter how much someone promises to not abuse the back door, or how hard they try and protect the back door, it's like a chain, it's only as strong as its weakest link.

[Daradon]

Government spends tens of billions a year to monitor communications around the globe.

Still misses stuff...



Although I've always been very libertarian about privacy issues, this just goes to show the waste in the US (militarily)budget.

Monitor everything... still ask for hack...

There's gotta be a meme for this.